feat(email): add ImapProvider (generic IMAP for unsupported providers)

b3 of the multi-provider email roadmap. Adds ImapConnection model + table
(reconciler pattern, SQLite+MySQL), ImapService (MailKit-backed IMAP client),
ImapProvider implementing the existing IEmailProvider contract unchanged,
and ImapController for credential-based connect (no OAuth — user supplies
host/username/password directly, verified by a live connect before storage).

Scope, documented inline with ponytail: comments:
- INBOX only, no multi-folder support.
- Thread grouping approximates the References/In-Reply-To chain root rather
  than the IMAP THREAD extension, which not every server implements.
- External message ids are IMAP UIDs, scoped to the connection's current
  UIDVALIDITY.

Security: ran the security-audit skill against this diff (credential
handling + arbitrary-host connect is exactly the class of change the
standing security gate exists for). Found and fixed a real SSRF: the
connect endpoint let an authenticated user point the server at an
arbitrary host:port with no internal-range check, and connect-vs-auth
failure was distinguishable to the caller -- together a working oracle to
fingerprint internal services (loopback/RFC1918/link-local/cloud metadata)
from the server's network position. Fixed with EnsureHostIsExternalAsync
(DNS-resolve + reject internal ranges, re-checked on every reconnect to
close the DNS-rebinding gap) and a single generic failure message that no
longer distinguishes connect vs auth failure. 7 regression tests added.

Dependency: MailKit 4.17.0 (MIT license) on JobTrackerBackend.csproj --
stdlib has no IMAP client; hand-rolling IMAP4rev1 (TLS, SASL, MIME parsing)
would be a large, security-sensitive protocol implementation nobody asked
for, so this is the correct dependency, not a stdlib substitute.

168/168 green (161 existing + 7 new SSRF regression tests; the earlier
14 IMAP feature tests are included in the 161).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

JobTrackerApi/Services/StartupInitializationExtensions.cs

@@ -386,6 +386,31 @@ public static class StartupInitializationExtensions
                     Exec(c, """CREATE UNIQUE INDEX IF NOT EXISTS "IX_MicrosoftGraphConnections_OwnerUserId_MailAddress" ON "MicrosoftGraphConnections" ("OwnerUserId", "MailAddress");""");
                 }
 
+                static void EnsureImapConnectionsTable(DbConnection c)
+                {
+                    Exec(c, """
+        CREATE TABLE IF NOT EXISTS "ImapConnections" (
+            "Id" INTEGER NOT NULL CONSTRAINT "PK_ImapConnections" PRIMARY KEY AUTOINCREMENT,
+            "OwnerUserId" TEXT NOT NULL,
+            "Host" TEXT NOT NULL,
+            "Port" INTEGER NOT NULL,
+            "UseSsl" INTEGER NOT NULL,
+            "Username" TEXT NOT NULL,
+            "EncryptedPassword" TEXT NOT NULL,
+            "ConnectedAt" TEXT NOT NULL,
+            "LastSyncedAt" TEXT NULL,
+            "LastSyncAttemptedAt" TEXT NULL,
+            "LastSyncSucceededAt" TEXT NULL,
+            "LastSyncMode" TEXT NULL,
+            "LastSyncSource" TEXT NULL,
+            "LastSyncStatus" TEXT NULL,
+            "LastSyncError" TEXT NULL
+        );
+        """);
+
+                    Exec(c, """CREATE UNIQUE INDEX IF NOT EXISTS "IX_ImapConnections_OwnerUserId" ON "ImapConnections" ("OwnerUserId");""");
+                }
+
                 static void EnsureCvTables(DbConnection c)
                 {
                     Exec(c, """
@@ -455,6 +480,7 @@ public static class StartupInitializationExtensions
 
                 EnsureGmailConnectionsTable(conn);
                 EnsureMicrosoftGraphConnectionsTable(conn);
+                EnsureImapConnectionsTable(conn);
                 EnsureCvTables(conn);
 
                 // Legacy DB signature: migration history exists (AddCorrespondence applied), but 20260310195000 not recorded,
@@ -634,6 +660,7 @@ public static class StartupInitializationExtensions
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "JobEvents", "Id");
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "GmailConnections", "Id");
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "MicrosoftGraphConnections", "Id");
+                    EnsureMySqlAutoIncrementPrimaryKey(conn, "ImapConnections", "Id");
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "CvUploadArtifacts", "Id");
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "CvExtractionRuns", "Id");
                     EnsureMySqlAutoIncrementPrimaryKey(conn, "TailoredCvDrafts", "Id");
@@ -851,6 +878,30 @@ public static class StartupInitializationExtensions
                         cmd.ExecuteNonQuery();
                     }
 
+                    if (!HasMySqlTable(conn, "ImapConnections"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = @"CREATE TABLE IF NOT EXISTS `ImapConnections` (
+        `Id` int NOT NULL AUTO_INCREMENT,
+        `OwnerUserId` varchar(255) NOT NULL,
+        `Host` varchar(255) NOT NULL,
+        `Port` int NOT NULL,
+        `UseSsl` tinyint(1) NOT NULL,
+        `Username` varchar(255) NOT NULL,
+        `EncryptedPassword` longtext NOT NULL,
+        `ConnectedAt` datetime(6) NOT NULL,
+        `LastSyncedAt` datetime(6) NULL,
+        `LastSyncAttemptedAt` datetime(6) NULL,
+        `LastSyncSucceededAt` datetime(6) NULL,
+        `LastSyncMode` varchar(255) NULL,
+        `LastSyncSource` varchar(255) NULL,
+        `LastSyncStatus` varchar(255) NULL,
+        `LastSyncError` longtext NULL,
+        PRIMARY KEY (`Id`)
+        );";
+                        cmd.ExecuteNonQuery();
+                    }
+
                     if (!HasMySqlTable(conn, "TailoredCvDrafts"))
                     {
                         using var cmd = conn.CreateCommand();
@@ -956,6 +1007,13 @@ public static class StartupInitializationExtensions
                         cmd.ExecuteNonQuery();
                     }
 
+                    if (!MySqlIndexExists(conn, "ImapConnections", "IX_ImapConnections_OwnerUserId"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = "CREATE UNIQUE INDEX `IX_ImapConnections_OwnerUserId` ON `ImapConnections` (`OwnerUserId`);";
+                        cmd.ExecuteNonQuery();
+                    }
+
                     if (!MySqlIndexExists(conn, "TailoredCvDrafts", "IX_TailoredCvDrafts_OwnerUserId_JobApplicationId"))
                     {
                         using var cmd = conn.CreateCommand();